# Gitea Actions workflow for hrafn.
#
# Runs on every push to main (and on manual workflow_dispatch). Drives
# the in-repo elway playbook (playbooks/deploy.yaml) — that file is the
# single source of truth for "how hrafn is deployed", manual or automated.
#
# Replaces the hand-rsync deploy. Two things change as a result:
#   - the image is tagged with the commit SHA rather than a fixed `v1`,
#     so the host can answer "what is running" and a rollback is a retag
#   - only the build context ships (Dockerfile, compose.yaml,
#     pyproject.toml, README.md, src/) instead of the whole working tree,
#     so tests/, docs/, persistent-memory.md and friends stop living in
#     /opt/docker/compose/hrafn on the server
#
# Required Actions secrets — both already exist at user scope on vh from
# the nevermore/task-board wiring, so there is nothing new to provision:
#
#   DEPLOY_SSH_KEY    Private SSH key authorized for lkraven@ana-docker.
#   MGMT_REPO_TOKEN   Gitea PAT (read:repository) on vh/esh-pfi-infrastructure.
#                     Needed to clone elway from the management repo.
#
# NOT handled here: .env. It is host-owned, 0600, holds the bearer token,
# and is provisioned once from vault item ana-docker/hrafn/bearer-token.
# The playbook refuses to deploy if it is missing or not 0600.

name: Deploy hrafn

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: pfi-fleet

    steps:
      - name: Install playbook prerequisites
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends \
            python3 python3-yaml openssh-client tar
          rm -rf /var/lib/apt/lists/*

      - name: Checkout hrafn (triggering repo)
        uses: actions/checkout@v4

      - name: Checkout management repo (for elway)
        uses: actions/checkout@v4
        with:
          repository: vh/esh-pfi-infrastructure
          token: ${{ secrets.MGMT_REPO_TOKEN }}
          path: _mgmt

      - name: Configure SSH to ana-docker
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          cat > ~/.ssh/config <<'EOF'
          Host ana-docker
            HostName 10.250.50.70
            User lkraven
            IdentityFile ~/.ssh/id_ed25519
            StrictHostKeyChecking accept-new
          EOF
          chmod 600 ~/.ssh/config

      - name: Build the deploy context
        # Only what the Dockerfile actually consumes, plus compose.yaml.
        # Deliberately excludes tests/, docs/, persistent-memory.md,
        # ROADMAP.md, CLAUDE.md, LICENSE and .env — none of them belong
        # in a production compose directory.
        run: |
          mkdir -p dist
          tar czf dist/hrafn-context.tgz \
            Dockerfile compose.yaml pyproject.toml README.md src
          echo "context contents:"
          tar tzf dist/hrafn-context.tgz

      - name: Deploy hrafn (in-repo elway playbook)
        # hrafn_sha becomes the image tag and is written to
        # /opt/docker/compose/hrafn/.deployed on the host.
        run: |
          _mgmt/scripts/elway ana-docker \
            --playbook playbooks/deploy.yaml \
            --var hrafn_sha=${GITHUB_SHA::12}